W32/Tupofse Virus

 Virus Information - W32/Tupofse Virus:

W32/Tupofse is a file-infecting virus. The virus will infect Microsoft Word and Microsoft Excel files.

Upon execution, the virus creates kspool.exe and avwav32.dll in the Windows System folder.
It also creates UNINSTX(single character).tmp in the Current User\Temp folder.

It modifies the registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The virus attempts to infect files with the .doc and .xls extensions.

It replaces the original file extenstion with the extension .exe.

The virus may also stop the MSSQL service.